CVE-2025-49844

CVE-2025-49844, dubbed "RediShell," is a use-after-free (CWE-416) in Redis's embedded Lua scripting engine that per vendor and press coverage has existed for roughly 13 years in all Redis versions with Lua scripting enabled. An authenticated user triggers it by submitting a specially crafted Lua script (via EVAL/EVALSHA) that manipulates the garbage collector and causes a use-after-free condition. Successful exploitation can lead to remote code execution in the context of the redis-server process; the CVSS 3.1 score of 9.9 (critical) reflects network reachability, low required privileges, and changed scope. Redis versions up to and including 8.2.1 are affected, with 8.2.2 containing the fix, and the CPE data also lists the Valkey fork as affected. No confirmed in-the-wild exploitation is reported (not in CISA KEV), but a public proof-of-concept exists and EPSS assigns an 82.3% probability of exploitation within 30 days (100th percentile).

What to do: Upgrade redis-server to version 8.2.2 or later; for Valkey, apply the vendor's corresponding Lua fix when available. If patching is not immediately possible, restrict the EVAL and EVALSHA commands using Redis ACLs so users cannot execute Lua scripts, and verify that any internet-exposed instances require authentication. Review logs for unexpected or anomalous EVAL/EVALSHA usage from authenticated clients.